High-tech security information needs better dissemination

After the London launch of CPJ's Attacks
on the Press at the Frontline Club this week, I had an opportunity to
talk to a number of young journalists setting out to regions where reporters
are frequently at risk. As CPJ Executive Director Joel Simon noted,
these discussions took on an extra poignancy the next day, with the news of the
death of Marie Colvin and Rémi Ochlik.

What stood out in the conversation was how often the reporters I spoke to were
aware generally of the dangers from using high-tech tools, but felt they were
being provided with little practical guidance, either from the media
organizations that employed them, or from external sources.

One reporter, due to leave on assignment for Pakistan in a few weeks,
was
pursuing his own research on how to bypass local censorship and protect
his communications from surveillance. His decisions (using a virtual private
network, keeping his contact list off his mobile phone) were sensible, but
were entirely down to his own research. In that sense, he is being faced with
the the info security equivalent of packing off a correspondent into a war zone
with no insurance and a first aid kit.

At CPJ, we've been long aware of this widening gulf between the growing risk of
journalist's use of technology and institutional knowledge, which is one of the
reasons why our forthcoming journalists' security manual has a chapter
specifically on information security. But one of the real challenges in
providing any advice is that the environment keeps changing. Substantive advice
depends on understanding the capabilities of those targeting journalists, as
well as new countermeasures that might be taken.

The ongoingdiscussion of whether Colvin and Ochlik's location was uncovered by
tracking their satellite phone transmissions highlights that problem. It's no
surprise to technologists that satphones leak location data. As a matter of
simple physics, satphones broadcast a signal that can be detected, and which looks
very different from the more prevalent mobile phones. What is novel
is the idea that journalists, who may use satphones more than
others in an urban war zone like Homs, may be specifically identified
via their satphone use, and that the Syrian government forces might
have the capability to act on that information.

What are the best sources for the knowledge that journalists need?
Unsurprisingly, it's journalists -- both those on the ground, and those
researching the companies
that make and sell such tools to regimes like Syria. But identifying the
policies and equipment that can lead to fatalities is only part of the
story. We need to turn the research into effective, practical advice.
What we need is better and
faster and public sharing of such intelligence between reporters, media
organizations, and activists.

San Francisco-based CPJ Internet Advocacy Coordinator Danny O’Brien has worked globally as a journalist and activist covering technology and digital rights. Follow him on Twitter @danny_at_cpj.